@panchr/tyr 0.1.0

package/src/commands/stats.ts

@@ -0,0 +1,154 @@
+import { defineCommand } from "citty";
+import { parseTime, rejectUnknownArgs } from "../args.ts";
+import { closeDb, getDb } from "../db.ts";
+
+const statsArgs = {
+	since: {
+		type: "string" as const,
+		description:
+			"Show stats for entries after timestamp (ISO or relative: 1h, 30m, 7d)",
+	},
+	json: {
+		type: "boolean" as const,
+		description: "Output raw JSON",
+	},
+};
+
+interface DecisionCount {
+	decision: string;
+	count: number;
+}
+
+interface ProviderCount {
+	provider: string | null;
+	count: number;
+}
+
+export default defineCommand({
+	meta: {
+		name: "stats",
+		description: "Show permission check statistics",
+	},
+	args: statsArgs,
+	async run({ args, rawArgs }) {
+		rejectUnknownArgs(rawArgs, statsArgs);
+
+		let since: number | undefined;
+		if (args.since) {
+			const t = parseTime(args.since);
+			if (!t) {
+				console.error(`Invalid --since value: ${args.since}`);
+				process.exit(1);
+				return;
+			}
+			since = t.getTime();
+		}
+
+		const db = getDb();
+		const conditions: string[] = [];
+		const params: number[] = [];
+
+		if (since !== undefined) {
+			conditions.push("timestamp >= ?");
+			params.push(since);
+		}
+
+		const whereClause =
+			conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
+
+		// Total count
+		const totalRow = db
+			.query(`SELECT COUNT(*) as count FROM logs ${whereClause}`)
+			.get(...params) as { count: number };
+		const total = totalRow.count;
+
+		// Decisions by type
+		const decisionRows = db
+			.query(
+				`SELECT decision, COUNT(*) as count FROM logs ${whereClause} GROUP BY decision ORDER BY count DESC`,
+			)
+			.all(...params) as DecisionCount[];
+
+		// Cache hit rate
+		const cacheRow = db
+			.query(
+				`SELECT SUM(cached) as hits, COUNT(*) as total FROM logs ${whereClause}`,
+			)
+			.get(...params) as { hits: number | null; total: number };
+		const cacheHits = cacheRow.hits ?? 0;
+		const cacheRate =
+			cacheRow.total > 0 ? (cacheHits / cacheRow.total) * 100 : 0;
+
+		// Provider breakdown
+		const providerRows = db
+			.query(
+				`SELECT provider, COUNT(*) as count FROM logs ${whereClause} GROUP BY provider ORDER BY count DESC`,
+			)
+			.all(...params) as ProviderCount[];
+
+		// Auto-approvals (allow decisions = effort saved)
+		const allowConditions = [...conditions, "decision = 'allow'"];
+		const allowWhere = `WHERE ${allowConditions.join(" AND ")}`;
+		const allowRow = db
+			.query(`SELECT COUNT(*) as count FROM logs ${allowWhere}`)
+			.get(...params) as { count: number };
+
+		const stats = {
+			total,
+			decisions: Object.fromEntries(
+				decisionRows.map((r) => [r.decision, r.count]),
+			),
+			cache: {
+				hits: cacheHits,
+				rate: Math.round(cacheRate * 10) / 10,
+			},
+			providers: Object.fromEntries(
+				providerRows.map((r) => [r.provider ?? "none", r.count]),
+			),
+			autoApprovals: allowRow.count,
+		};
+
+		if (args.json) {
+			console.log(JSON.stringify(stats));
+			closeDb();
+			return;
+		}
+
+		// Human-readable output
+		console.log("Permission Check Statistics");
+		if (args.since) {
+			console.log(`  Period: since ${args.since}`);
+		}
+		console.log(`  Total checks: ${total}`);
+		console.log();
+
+		console.log("Decisions:");
+		for (const type of ["allow", "deny", "abstain", "error"]) {
+			const count = stats.decisions[type] ?? 0;
+			const pct = total > 0 ? ((count / total) * 100).toFixed(1) : "0.0";
+			console.log(
+				`  ${type.padEnd(10)} ${String(count).padStart(6)}  (${pct}%)`,
+			);
+		}
+		console.log();
+
+		console.log("Cache:");
+		console.log(`  Hit rate: ${stats.cache.rate}% (${cacheHits}/${total})`);
+		console.log();
+
+		console.log("Providers:");
+		if (providerRows.length === 0) {
+			console.log("  (none)");
+		} else {
+			for (const row of providerRows) {
+				const name = row.provider ?? "none";
+				console.log(`  ${name.padEnd(20)} ${String(row.count).padStart(6)}`);
+			}
+		}
+		console.log();
+
+		console.log(`Auto-approvals (user effort saved): ${stats.autoApprovals}`);
+
+		closeDb();
+	},
+});

package/src/commands/suggest.ts

@@ -0,0 +1,184 @@
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { defineCommand } from "citty";
+import {
+	extractBashPatterns,
+	matchPattern,
+	settingsPaths,
+} from "../agents/claude.ts";
+import { rejectUnknownArgs } from "../args.ts";
+import { closeDb, getDb } from "../db.ts";
+import { readSettings, writeSettings } from "../install.ts";
+
+const suggestArgs = {
+	apply: {
+		type: "boolean" as const,
+		description: "Write suggestions into Claude's settings.json",
+	},
+	global: {
+		type: "boolean" as const,
+		description: "Target global (~/.claude/settings.json)",
+	},
+	project: {
+		type: "boolean" as const,
+		description: "Target project (./.claude/settings.json)",
+	},
+	"min-count": {
+		type: "string" as const,
+		description: "Minimum approval count to suggest (default: 5)",
+	},
+	json: {
+		type: "boolean" as const,
+		description: "Output raw JSON",
+	},
+};
+
+interface CommandFrequency {
+	tool_input: string;
+	count: number;
+}
+
+export interface Suggestion {
+	command: string;
+	count: number;
+	rule: string;
+}
+
+/** Query frequently-allowed commands and filter out those already in allow lists. */
+export function getSuggestions(
+	minCount: number,
+	allowPatterns: string[],
+): Suggestion[] {
+	const db = getDb();
+
+	const rows = db
+		.query(
+			`SELECT tool_input, COUNT(*) as count
+			 FROM logs
+			 WHERE decision = 'allow' AND mode IS NULL AND tool_name = 'Bash'
+			 GROUP BY tool_input
+			 HAVING COUNT(*) >= ?
+			 ORDER BY COUNT(*) DESC`,
+		)
+		.all(minCount) as CommandFrequency[];
+
+	const suggestions: Suggestion[] = [];
+	for (const row of rows) {
+		const alreadyAllowed = allowPatterns.some((p) =>
+			matchPattern(p, row.tool_input),
+		);
+		if (!alreadyAllowed) {
+			suggestions.push({
+				command: row.tool_input,
+				count: row.count,
+				rule: `Bash(${row.tool_input})`,
+			});
+		}
+	}
+
+	return suggestions;
+}
+
+/** Merge new allow rules into existing settings without clobbering. */
+export function mergeAllowRules(
+	settings: Record<string, unknown>,
+	rules: string[],
+): Record<string, unknown> {
+	const result = { ...settings };
+	const perms = (result.permissions ?? {}) as Record<string, unknown>;
+	const existing = Array.isArray(perms.allow) ? (perms.allow as string[]) : [];
+
+	const existingSet = new Set(existing);
+	const merged = [...existing, ...rules.filter((r) => !existingSet.has(r))];
+
+	result.permissions = { ...perms, allow: merged };
+	return result;
+}
+
+export default defineCommand({
+	meta: {
+		name: "suggest",
+		description:
+			"Suggest permissions to add to Claude settings based on decision history",
+	},
+	args: suggestArgs,
+	async run({ args, rawArgs }) {
+		rejectUnknownArgs(rawArgs, suggestArgs);
+
+		if (args.global && args.project) {
+			console.error("Cannot specify both --global and --project");
+			process.exit(1);
+			return;
+		}
+
+		const minCount = args["min-count"] ? Number(args["min-count"]) : 5;
+		if (!Number.isFinite(minCount) || minCount < 1) {
+			console.error(`Invalid --min-count value: ${args["min-count"]}`);
+			process.exit(1);
+			return;
+		}
+
+		try {
+			// Load all allow patterns from Claude settings to filter suggestions
+			const allPaths = settingsPaths(process.cwd());
+			const allowPatterns: string[] = [];
+			for (const path of allPaths) {
+				const settings = await readSettings(path);
+				const perms = settings.permissions as
+					| Record<string, unknown>
+					| undefined;
+				if (perms && Array.isArray(perms.allow)) {
+					allowPatterns.push(...extractBashPatterns(perms.allow));
+				}
+			}
+
+			const suggestions = getSuggestions(minCount, allowPatterns);
+
+			if (args.json) {
+				console.log(JSON.stringify(suggestions));
+				return;
+			}
+
+			if (suggestions.length === 0) {
+				console.log("No new suggestions found.");
+				return;
+			}
+
+			if (!args.apply) {
+				console.log(
+					`Suggested allow rules (commands approved >= ${minCount} times):`,
+				);
+				console.log();
+				for (const s of suggestions) {
+					console.log(`  ${s.rule}  (${s.count} approvals)`);
+				}
+				console.log();
+				console.log("Run with --apply to add these rules to Claude settings.");
+				return;
+			}
+
+			// Apply mode: write rules to settings
+			const scope: "global" | "project" = args.project ? "project" : "global";
+			const configDir =
+				process.env.CLAUDE_CONFIG_DIR ?? join(homedir(), ".claude");
+			const settingsPath =
+				scope === "global"
+					? join(configDir, "settings.json")
+					: join(process.cwd(), ".claude", "settings.json");
+			const settings = await readSettings(settingsPath);
+
+			const newRules = suggestions.map((s) => s.rule);
+			const merged = mergeAllowRules(settings, newRules);
+			await writeSettings(settingsPath, merged);
+
+			console.log(
+				`Added ${newRules.length} allow rule(s) to ${scope} settings (${settingsPath}):`,
+			);
+			for (const rule of newRules) {
+				console.log(`  ${rule}`);
+			}
+		} finally {
+			closeDb();
+		}
+	},
+});

package/src/commands/uninstall.ts

@@ -0,0 +1,54 @@
+import { defineCommand } from "citty";
+import { rejectUnknownArgs } from "../args.ts";
+import {
+	getSettingsPath,
+	readSettings,
+	removeHook,
+	writeSettings,
+} from "../install.ts";
+
+const uninstallArgs = {
+	global: {
+		type: "boolean" as const,
+		description: "Remove from ~/.claude/settings.json",
+	},
+	project: {
+		type: "boolean" as const,
+		description: "Remove from .claude/settings.json (default)",
+	},
+	"dry-run": {
+		type: "boolean" as const,
+		description: "Print what would be written without modifying anything",
+	},
+};
+
+export default defineCommand({
+	meta: {
+		name: "uninstall",
+		description: "Remove the tyr hook from Claude Code settings",
+	},
+	args: uninstallArgs,
+	async run({ args, rawArgs }) {
+		rejectUnknownArgs(rawArgs, uninstallArgs);
+		const scope = args.global ? "global" : "project";
+		const dryRun = args["dry-run"] ?? false;
+		const settingsPath = getSettingsPath(scope);
+
+		const settings = await readSettings(settingsPath);
+		const updated = removeHook(settings);
+
+		if (!updated) {
+			console.log(`tyr hook not found in ${settingsPath}`);
+			return;
+		}
+
+		if (dryRun) {
+			console.log(`Would write to ${settingsPath}:\n`);
+			console.log(JSON.stringify(updated, null, 2));
+			return;
+		}
+
+		await writeSettings(settingsPath, updated);
+		console.log(`Removed tyr hook from ${settingsPath}`);
+	},
+});

package/src/commands/version.ts

@@ -0,0 +1,14 @@
+import { defineCommand } from "citty";
+import { VERSION } from "../version.ts";
+
+export default defineCommand({
+	meta: {
+		name: "version",
+		description: "Print tyr version and runtime info",
+	},
+	run() {
+		console.log(`tyr ${VERSION}`);
+		console.log(`bun ${Bun.version}`);
+		console.log(`${process.platform} ${process.arch}`);
+	},
+});

package/src/config.ts

@@ -0,0 +1,222 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import { PROVIDER_NAMES, type TyrConfig, TyrConfigSchema } from "./types.ts";
+
+const CONFIG_DIR = join(homedir(), ".config", "tyr");
+const CONFIG_FILE = join(CONFIG_DIR, "config.json");
+
+/** Return the path to tyr's config file. */
+export function getConfigPath(): string {
+	return process.env.TYR_CONFIG_FILE ?? CONFIG_FILE;
+}
+
+/** Return the path to tyr's `.env` file (next to config.json). */
+export function getEnvPath(): string {
+	return join(dirname(getConfigPath()), ".env");
+}
+
+/** Parse `.env` file content into key-value pairs. */
+function parseEnv(text: string): Record<string, string> {
+	const result: Record<string, string> = {};
+	for (const line of text.split("\n")) {
+		const trimmed = line.trim();
+		if (!trimmed || trimmed.startsWith("#")) continue;
+		const eq = trimmed.indexOf("=");
+		if (eq === -1) continue;
+		const key = trimmed.slice(0, eq).trim();
+		let value = trimmed.slice(eq + 1).trim();
+		// Strip matching quotes
+		if (
+			(value.startsWith('"') && value.endsWith('"')) ||
+			(value.startsWith("'") && value.endsWith("'"))
+		) {
+			value = value.slice(1, -1);
+		}
+		result[key] = value;
+	}
+	return result;
+}
+
+/** Load `.env` from the tyr config directory into `process.env`.
+ *  Existing env vars take precedence. No-ops if the file doesn't exist. */
+export function loadEnvFile(): void {
+	const vars = readEnvFile();
+	for (const [key, value] of Object.entries(vars)) {
+		if (process.env[key] === undefined) {
+			process.env[key] = value;
+		}
+	}
+}
+
+/** Read and return parsed key-value pairs from the `.env` file. */
+export function readEnvFile(): Record<string, string> {
+	const envPath = getEnvPath();
+	let text: string;
+	try {
+		text = readFileSync(envPath, "utf-8");
+	} catch {
+		return {};
+	}
+	return parseEnv(text);
+}
+
+/** Upsert a key in the `.env` file. Creates the file if missing. */
+export function writeEnvVar(key: string, value: string): void {
+	const envPath = getEnvPath();
+	let lines: string[] = [];
+	if (existsSync(envPath)) {
+		lines = readFileSync(envPath, "utf-8").split("\n");
+	}
+
+	const prefix = `${key}=`;
+	let found = false;
+	for (let i = 0; i < lines.length; i++) {
+		const line = lines[i];
+		if (line === undefined) continue;
+		const trimmed = line.trim();
+		if (trimmed.startsWith("#")) continue;
+		if (trimmed.startsWith(prefix) || trimmed.startsWith(`${key} =`)) {
+			lines[i] = `${key}=${value}`;
+			found = true;
+			break;
+		}
+	}
+	if (!found) {
+		lines.push(`${key}=${value}`);
+	}
+
+	// Ensure trailing newline
+	const content = lines.join("\n").replace(/\n*$/, "\n");
+	const dir = dirname(envPath);
+	mkdirSync(dir, { recursive: true });
+	writeFileSync(envPath, content, "utf-8");
+}
+
+/** Map of all settable config key paths to their expected types. */
+const VALID_KEY_TYPES: Record<
+	string,
+	"boolean" | "string" | "number" | "providers"
+> = {
+	providers: "providers",
+	failOpen: "boolean",
+	verboseLog: "boolean",
+	logRetention: "string",
+	"claude.model": "string",
+	"claude.timeout": "number",
+	"claude.canDeny": "boolean",
+	"openrouter.model": "string",
+	"openrouter.endpoint": "string",
+	"openrouter.timeout": "number",
+	"openrouter.canDeny": "boolean",
+};
+
+/** Check if a string is a valid config key (supports dot notation for claude.*, openrouter.*). */
+export function isValidKey(key: string): boolean {
+	return key in VALID_KEY_TYPES;
+}
+
+/** Strip // and /* comments from a JSON string, preserving strings. */
+export function stripJsonComments(text: string): string {
+	let result = "";
+	let i = 0;
+	while (i < text.length) {
+		// String literal — copy verbatim including escapes
+		if (text[i] === '"') {
+			let j = i + 1;
+			while (j < text.length && text[j] !== '"') {
+				if (text[j] === "\\") j++; // skip escaped char
+				j++;
+			}
+			result += text.slice(i, j + 1);
+			i = j + 1;
+			continue;
+		}
+		// Single-line comment
+		if (text[i] === "/" && text[i + 1] === "/") {
+			const nl = text.indexOf("\n", i);
+			i = nl === -1 ? text.length : nl;
+			continue;
+		}
+		// Block comment
+		if (text[i] === "/" && text[i + 1] === "*") {
+			const end = text.indexOf("*/", i + 2);
+			i = end === -1 ? text.length : end + 2;
+			continue;
+		}
+		result += text[i];
+		i++;
+	}
+	return result;
+}
+
+/** Read the raw JSON from tyr's config file without schema validation.
+ *  Returns an empty object when the file is missing. Supports JSONC. */
+export async function readRawConfig(): Promise<Record<string, unknown>> {
+	const path = getConfigPath();
+	let text: string;
+	try {
+		text = await readFile(path, "utf-8");
+	} catch (err: unknown) {
+		if (
+			err instanceof Error &&
+			"code" in err &&
+			(err as NodeJS.ErrnoException).code === "ENOENT"
+		) {
+			return {};
+		}
+		throw err;
+	}
+	return JSON.parse(stripJsonComments(text)) as Record<string, unknown>;
+}
+
+/** Read tyr's config. Returns defaults when the file is missing.
+ *  Supports JSONC (JSON with Comments). Rejects unrecognized keys. */
+export async function readConfig(): Promise<TyrConfig> {
+	const raw = await readRawConfig();
+	return TyrConfigSchema.strict().parse(raw);
+}
+
+/** Write config to disk, creating parent directories as needed. */
+export async function writeConfig(config: TyrConfig): Promise<void> {
+	const path = getConfigPath();
+	await mkdir(dirname(path), { recursive: true });
+	await writeFile(path, `${JSON.stringify(config, null, 2)}\n`, "utf-8");
+}
+
+/** Parse a string value into the expected type for a config key path. */
+export function parseValue(
+	key: string,
+	value: string,
+): boolean | string | number | string[] | null {
+	const expected = VALID_KEY_TYPES[key];
+	if (!expected) return null;
+	if (expected === "boolean") {
+		if (value === "true") return true;
+		if (value === "false") return false;
+		return null;
+	}
+	if (expected === "string") {
+		return value;
+	}
+	if (expected === "number") {
+		if (value.trim() === "") return null;
+		const num = Number(value);
+		if (Number.isFinite(num)) return num;
+		return null;
+	}
+	if (expected === "providers") {
+		const valid = new Set<string>(PROVIDER_NAMES);
+		const names = value
+			.split(",")
+			.map((s) => s.trim())
+			.filter(Boolean);
+		if (names.length === 0) return null;
+		for (const n of names) {
+			if (!valid.has(n)) return null;
+		}
+		return names;
+	}
+	return null;
+}